CVE-2023-28784
📛 CVE Title
WordPress Contest Gallery Plugin <= 21.1.2 is vulnerable to Cross Site Scripting (XSS)
Description
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <= 21.1.2 versions.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- Patchstack
- CVSS severity
- HIGH
- CVSS score
- 7.1 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L- Effective score
- 7.1 / 10 HIGH source: CNA overview
- CWE(s)
-
CWE-79 - Reserved
- 2023-03-23
- Published
- 2023-06-22 13:21 UTC
- Last updated
- 2026-04-28 18:08 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28784.json
- Linked Threat
- CVE-2023-28784 — Contest Gallery <= 21.1.2 - Reflected Cross-Site Scripting
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2023-06-22 12:15:11 UTC
- NVD last modified
- 2026-06-17 05:48:46 UTC
- NVD CVSS v3.1
- 7.1 / 10 HIGH source: audit@patchstack.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L- Exploitability subscore
- 2.8 / 10
- Impact subscore
- 3.7 / 10
- EPSS score
- 0.0038 (probability of exploitation in next 30 days)
- EPSS percentile
- 30.83% vs all CVEs — higher = more likely to be exploited, as of 2026-07-27
NVD / KEV / EPSS data refreshed 2026-07-28 08:10 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2023-32419 - Assigner
- Patchstack
- Published
- Jun 22, 2023, 11:21:07 AM
- Updated
- Apr 28, 2026, 4:08:16 PM
- EUVD base score (CVSS 3.1)
-
7.1 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - EUVD-reported EPSS
- 0.1200
- Vendors
- Contest Gallery
- Products
-
Contest Gallery (n/a ≤21.1.2)
- Aliases
-
GHSA-p8x8-qh7x-66mh
ENISA description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <= 21.1.2 versions.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Contest Gallery | Contest Gallery |
n/a (affected)
|
— |
Affected products — CPE 2.3 (1) NVD
NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.
cpe:2.3:a:contest-gallery:contest_gallery:*:*:*:*:*:wordpress:*:*
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
MITRE references (1) cveawg.mitre.org
Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.
Web references (5)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- http://cwe.mitre.org/data/definitions/79.html rapid7:cwe.mitre.org
- https://attackerkb.com/topics/CVE-2023-28784 rapid7:attackerkb.com
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-32419 rapid7:euvd.enisa.europa.eu
- https://www.cve.org/CVERecord?id=CVE-2023-28784 rapid7:www.cve.org
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7dbd3b23-cebc-4212-bcae-c6f23031c040?source=api-prod rapid7:www.wordfence.com
NVD-tagged references (2)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://patchstack.com/database/vulnerability/contest-gallery/wordpress-contest-gallery-plugin-21-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve audit@patchstack.com Third Party Advisory
- https://patchstack.com/database/vulnerability/contest-gallery/wordpress-contest-gallery-plugin-21-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
Indicators (1)
IOCs linked to the auto-promoted Threat row.
| Type | Value | VirusTotal | Attached |
|---|---|---|---|
| cve |
CVE-2023-28784
|
no local data | 2026-06-06 15:09 UTC |
Remediations (16)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:github.com
This means systems relying solely on eIBRS for Spectre V2 mitigation may not be fully protected without the microcode fix . Mitigation requires a microcode update (intel-microcode 20250512+) that fixes the asynchronous branch predictor update timing so that eIBRS and IBPB work as originally intended. No kernel changes are required.
2026-06-10 16:03 UTC -
web:www.rapid7.com
Patch management is the process of distributing and applying updates to software. These patches are often necessary to correct errors (also referred to as "vulnerabilities" or "bugs") in the software.
2026-06-10 16:03 UTC -
web:www.ibm.com
A list of recent, recommended, generally available (GA) updates for IBM WebSphere Application Server releases. Fix packs are cumulative. When a prerequisite or co-requisite fix pack is recommended, that specific fix pack or a later fix pack can be applied. For example, if fix pack 9.0.5.5 is required, applying fix pack 9.0.5.5, 9.0.5.6, or a later fix pack is valid.
2026-06-10 16:03 UTC -
web:thehackernews.com
Autonomous Remediation : vulnerabilities will be detected and fixed automatically, and in accordance with policy. Oversight, Not Micromanagement: humans will guide policy and handle exceptions, rather than approving every patch . From Reactive to Proactive: security will evolve continuously with threats instead of playing catch-up.
2026-06-10 16:03 UTC -
web:support.sap.com
SAP categorizes SAP Security Notes as Patch Day Security Not es and Support Package Security Notes, with the sole purpose of making you focus on important fixes on patch days and the rest to be implemented automatically during SP upgrades. For details refer to the SAP Security Notes FAQ.
2026-06-10 16:03 UTC -
Wordfence remediation: Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & StripeWordfence
Update to version 21.1.2.1, or a newer patched version
2026-06-06 15:09 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-22 06:14 UTC -
web:support.esri.com
Refer to the Issues Addressed with this Patch section for details about BUG-000171492. The new patch when shown as available in the ArcGIS Enterprise Patch Notification tool, is listed as ArcGIS Server Security 2025 Update 1 Patch with a release date of April 17, 2025; once installed, it is listed as ArcGIS Server Security 2025 Update 1 Patch B.
2026-05-22 06:14 UTC -
web:github.com
A new and improved community patch for BO3. . Contribute to shiversoftdev/t7patch development by creating an account on GitHub.
2026-05-22 06:14 UTC -
web:cybersecuritynews.com
Google released a critical Chrome update fixing multiple high-risk vulnerabilities that could enable arbitrary code execution.
2026-05-22 06:14 UTC -
web:www.cisco.com
This document describes a list of software versions that have incorporated fixes for Cisco IOS® XE Software Web UI Cisco bug ID CSCwh87343.
2026-05-22 06:14 UTC -
web:cyberpress.org
The third vulnerability, CVE -2026-44791 (GHSA-wrwr-h859-xh2r), is particularly alarming because it represents a patch bypass. It circumvents the previously issued fix for GHSA-hqr4-h3xv-9m3r in the XML node, reintroducing prototype pollution through a different code path. When chained with additional nodes, this too can escalate to RCE on the host.
2026-05-22 06:14 UTC -
web:www.oracle.com
This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.
2026-05-22 06:14 UTC -
web:cyberinsider.com
Google has released Chrome 148, one of the largest security update batches in the browser's history, patching 127 vulnerabilities.
2026-05-22 06:14 UTC -
web:www.windowslatest.com
Windows 11 March 2026 Patch Tuesday update adds Emoji 16.0, Sysmon, network speed test, reliability improvements, and security fixes.
2026-05-22 06:14 UTC -
web:access.redhat.com
Learn about our open source products, services, and company. You are here
2026-05-22 06:14 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2023-28784.json.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T13:51:38.682Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://patchstack.com/database/vulnerability/contest-gallery/wordpress-contest-gallery-plugin-21-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-28784",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-02T14:42:35.653613Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-02T14:48:16.813Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "contest-gallery",
"product": "Contest Gallery",
"vendor": "Contest Gallery",
"versions": [
{
"changes": [
{
"at": "21.1.2.1",
"status": "unaffected"
}
],
"lessThanOrEqual": "21.1.2",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "thiennv (Patchstack Alliance)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <=<span style=\"background-color: var(--wht);\">\u00a021.1.2 versions.</span>"
}
],
"value": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <=\u00a021.1.2 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-591",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-591 Reflected XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:08:16.996Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/vulnerability/contest-gallery/wordpress-contest-gallery-plugin-21-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to 21.1.2.1 or a higher version."
}
],
"value": "Update to 21.1.2.1 or a higher version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Contest Gallery Plugin <= 21.1.2 is vulnerable to Cross Site Scripting (XSS)",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2023-28784",
"datePublished": "2023-06-22T11:21:07.805Z",
"dateReserved": "2023-03-23T17:03:15.168Z",
"dateUpdated": "2026-04-28T16:08:16.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}